CVE-2026-49284

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking...

PT-2026-60892

Name of the Vulnerable Software and Affected Versions Skipper affected versions not specified Description The routesrv component exposes sensitive cluster-wide routing and cache infrastructure data over plain HTTP without any authentication. This allows any pod within the Kubernetes cluster to...

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

SUSE-SU-2026:22749-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

SUSE-SU-2026:22692-1 Security update for the Linux Kernel RT (Live Patch 19 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094....

CVE-2026-55203

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

PT-2026-60686

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description When operating in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server lacks a UnaryInterceptor, leaving Fetch endpoints unauthenticated...

RockyLinux 8 : nodejs:24 (RLSA-2026:39868)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:39868 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

The vulnerability of the Routing and Remote Access Service (RRAS) in Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Routing and Remote Access Service RRAS in Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

SUSE SLES15 Security Update : kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:3002-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3002-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.115 fixes various security issues The following security issues were fixed: -...

GHSA-XGCH-X3MX-CM3C safeurl is Missing IPv6 CIDR Ranges in Blocklist

The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: - 64:ff9b:1::/48: NAT64 local-use prefix RFC 8215 - 5f00::/16: Segment Routing SRv6 SIDs RFC 9602 - 3fff::/20: documentation prefix RFC 9637 -...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via message routing in the System.Net.Mail SMTP client. An attacker can spoof email messages by exploiting flaws in the SMTP client during message routing, causing messages to appear as though the...